CVE-2026-92782
Chroma through 1.5.9 Authorization Bypass via Collection Identifier
CVSS 4.0 8.6 HIGHCVSS 3.1 8.1 HIGHCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-92782
PublishedChroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in foreign collections by issuing requests under their own tenant path, bypassing authorization checks.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-92782 · CVE overview and exploitation status
cve-program · CVE-2026-92782
- https://github.com/chroma-core/chroma/issues/7462
- https://github.com/chroma-core/chroma
- https://github.com/chroma-core/chroma/blob/1.5.9/rust/frontend/src/server.rs#L469-L487
- https://github.com/chroma-core/chroma/blob/1.5.9/rust/frontend/src/get_collection_with_segments_provider.rs#L143-L160
- https://www.vulncheck.com/advisories/chroma-through-1.5.9-authorization-bypass-via-collection-identifier
Related changes
Linked by CVE identifierNo related changes are available here.